Geekblok

As some of you might know, there is interesting Exif header information in most of the jpeg images. On a unixlike system this information can be extracted from the original using jhead.

bq. $ jhead dsc02985.jpg
File name : dsc02985.jpg

File size : 1546562 bytes

File date : 2006:01:18 09:49:24

Camera make : SONY

Camera model : CYBERSHOT

Date/Time : 2002:07:06 14:18:37

Resolution : 2240 × 1680

Flash used : No

Focal length : 7.1mm

Exposure time: 0.0024 s (1/410)

Aperture : f/4.0

ISO equiv. : 100

Exposure : LandscapeMode

As can be seen I took this picture with my Sony Cybershot camera. Not too interesting. Another feature of jhead is that one can also extract thumbnails from the Exif header.

The thumbnail is probably there to speed up the browsing through the pictures on the small screen of the camera. jhead -h has the following thumbnail options:

bq. THUMBNAIL MANIPULATION:
-dt Remove exif integral thumbnails. Typically trims 10k

-st Save Exif thumbnail, if there is one, in file

If output file name contains the substring “&i” then the

image file name is substitute for the &i. Note that quotes around

the argument are required for the ‘&’ to be passed to the program.

An output name of ‘-’ causes thumbnail to be written to stdout

-rt Replace Exif thumbnail. Can only be done with headers that

already contain a thumbnail.

-rgt[size] Regnerate exif thumbnail. Only works if image already

contains a thumbail. size specifies maximum height or width of

thumbnail. Relies on ‘mogrify’ programs to be on path

My theory is that there must be software around that does not update the Exif thumbnail, when editing the original picture. That way one might be able to reconstruct the real picure, though with less detail. I did some small tests with both the Gimp under Linux and Photoshop under Windows, but both updated the thumbnail with the original.

Let’s have a look wether the discussed Reflectionmaker from B10m is modifying the thumbnails of the Exif header too. I used the picture dsc03066.jpg for this test. The reflected image has been stored as dsc03066-r.jpg
The first thing I noticed with a simple jhead command is that gd-jpeg, version 1.0 has been used.

bq. $ jhead dsc03066-r.jpg
File name : dsc03066-r.jpg

File size : 61710 bytes

File date : 2007:10:13 19:11:29

Resolution : 640 × 720

Comment : CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 80

Let’s try to get the thumbnail out:

bq. $ jhead -st “t_&i” dsc03066-r.jpg
Image contains no thumbnail

So they don’t do anything with the thumbnail at all, which does make some sense. I’ll keep on searching for strange things in the Exif headers and let you know what I’ll find.